fix(deps): floor all three brace-expansion majors on their complete fixes

CHANGELOG.md

@@ -9,6 +9,7 @@
 - **`pnpm version` no longer breaks with the `.hermes-plugin/` removal.** The `version` lifecycle script listed `.hermes-plugin` in its `git add`; `git add` exits 128 on a pathspec that matches nothing, which would have broken the documented release step (`pnpm version <patch|minor|major> --no-git-tag-version`) for every subsequent release. The stale path is dropped from the `git add` list.
 
 ### Security
+- **Floored all three dev-only `brace-expansion` majors on their complete fixes for GHSA-mh99-v99m-4gvg / CVE-2026-14257 (high)** — `1.1.16` → `1.1.18`, `2.1.3` → `2.1.4`, and both `5.0.7` and `5.0.8` → `5.0.9`. Three separate majors are reachable through the dev toolchain (`eslint` → `minimatch@3` on v1, `minimatch@9` on v2, `minimatch@10` on v5), and they are not API-compatible — minimatch 3 requires the v1 CommonJS API, so a single floor spanning them fails with `expand is not a function`. Each major therefore carries its own **two-sided** floor; the bounds must be two-sided because a bare `<5.0.9` also matches `1.1.18` and `2.1.4` under semver and would drag the CommonJS path onto the v5 ESM API. The advisory's own first-patched versions (`1.1.17` / `2.1.3` / `5.0.8`) are **not sufficient**: they bound the accumulator in `combine` but never thread `maxLength` into `expandSequence`, so the sequence path (`{1..N}`, `{a..z..k}`) stays capped only by item count and a padded sequence still materialises ~100,000 intermediate strings before the outer bound truncates (measured 4,606 ms / 176 MB RSS on `1.1.17` vs 9 ms / 61 MB on `1.1.18`, identical final output). Two of the four paths resolved here (`1.1.16`, `5.0.7`) were below even the advisory's floor. Adopted only after every release cleared this repo's 24-hour `minimumReleaseAge` gate, with no `minimumReleaseAgeExclude` carve-out and no audit suppression — `pnpm audit` will keep reporting the advisory until GitHub's metadata (which still lists `5.0.8` as first-patched, and so marks the entire v1 line vulnerable under semver) catches up. Dev toolchain only: `brace-expansion` is not in the shipped bundle, so the published package is unaffected, the committed bundle is byte-identical, and no version bump is owed. Matches apple-mail-mcp#123 — thanks to @jjoanna2-debug for the original finding.
 - Override the MCP SDK's transitive `@hono/node-server` and `fast-uri` dependencies to patched releases. This clears the path-traversal advisory in Hono's static file serving and the host-confusion advisories in `fast-uri` while the SDK's own dependency ranges still resolve vulnerable versions.
 
 ## [2.6.9] - 2026-07-22

pnpm-workspace.yaml

@@ -16,4 +16,21 @@ minimumReleaseAge: 1440
 # these security fixes.
 overrides:
   "@hono/node-server": 2.0.10
+  # GHSA-mh99-v99m-4gvg / CVE-2026-14257 (high): unbounded brace expansion.
+  # Dev toolchain only -- brace-expansion is not in the shipped bundle -- but
+  # three separate majors are reachable here (eslint -> minimatch@3 -> v1,
+  # minimatch@9 -> v2, minimatch@10 -> v5), so each is floored independently
+  # on its own complete release.
+  #
+  # The advisory's first-patched versions (1.1.17 / 2.1.3 / 5.0.8) are NOT
+  # sufficient: they bound the accumulator in combine() but never thread
+  # maxLength into expandSequence(), leaving the sequence path ({1..N},
+  # {a..z..k}) capped only by item count. 1.1.18 / 2.1.4 / 5.0.9 add it.
+  #
+  # The bounds must be two-sided. A bare "<5.0.9" also matches 1.1.18 and
+  # 2.1.4 under semver, and would force minimatch 3's CommonJS path onto the
+  # v5 ESM API ("expand is not a function").
+  "brace-expansion@>=1.0.0 <1.1.18": 1.1.18
+  "brace-expansion@>=2.0.0 <2.1.4": 2.1.4
+  "brace-expansion@>=5.0.0 <5.0.9": 5.0.9
   fast-uri: 3.1.4